After a cyber-criminal gang disrupted London hospitals and published nearly 400GB of private data on the darkweb, the National Crime Agency (NCA) is reportedly discussing plans for potential retaliation.

According to The Guardian, the NCA is in discussion with the National Cyber Security Centre (NSCS) on potential responses to the attack, which Russia-affiliated ransomware group Qilin took credit for.

The cyber-attack itself took place on June 3rd, and targeted Synnovis, a pathology laboratory which processes blood tests for the NHS in London.  and a swath of data was published to Qilin’s darkweb site on June 21st.

The cyber gang demanded $50m (£40m) in ransom for the data, which was left unpaid. On 21 June, the NHS revealed that a and a swath of data was published to Qilin’s darkweb site

The data was highly sensitive, and included patient names, birth dates, NHS numbers, and blood test descriptions.

Records for 300m patient interactions were stolen, as well as blood test results for cancer and HIV, The Guardian reported.

As a result of the attack, over 3,000 hospital and GP appointments and services continue to be disrupted. 1,134 planned operations were cancelled, and 2,194 outpatient appointments were postponed due to the disruption.

Recommended reading

• NHS Dumfries and Galloway Stolen Data Published on Dark Web
• NHS Scotland Confirms Data Theft
• NHS Dumfries and Galloway Hit by Cyber-attack

Blood stock shortages were a major cause of the delays to treatment as Synnovis’s systems were interrupted due to the attack. Vital information was encrypted during the attack, which infiltrated Synnovis’ computer system.

A source told The Guardian that the NCA has a specialist team working on the case to potentially remove the leaked data. Removing the data from the dark web, however, may be fruitless if Qilin copied the data.